multi-harness-orchestrator
Warn
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to automatically execute shell commands to interact with external agent harnesses like Claude Code and Gemini. It instructs the agent to 'shell harness CLIs' with task context.
- [DYNAMIC_EXECUTION]: The orchestrator assembles shell commands at runtime using string interpolation, such as
claude -p "injected rules + task". This dynamic construction of executable code from variable inputs poses a command injection risk. - [PROMPT_INJECTION]: The skill's description metadata contains a role-play directive ('Embody Frank DNA'), which attempts to override the agent's persona and behavior guidelines.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts tasks and rules for delegation, creating an injection surface for sub-agents.
- Ingestion points: Processes tasks/commands for delegation to external harnesses.
- Boundary markers: No explicit delimiters or warnings are used to isolate untrusted task content.
- Capability inventory: Shell command execution (CLI harnesses).
- Sanitization: There is no evidence of sanitization or escaping of task data before it is included in shell commands.
Audit Metadata